Please tell us about your use cases for sast-scan

[prabhu]

I am seeing the usage of scan (in terms of docker pulls) growing organically.

This is despite not adding a single new feature since 2021. I am keen to hear the use cases this project is solving/not solving for you and your organization.

You can reach me on prabhu at appthreat.com or on discord

[mkadp]

Hi Prabu,

Our reason for starting to use slscan was that we are going for ISO27001 compliance and are using a platform called Sprinto to manage the auditing and compliance process. This tool has automatic integration with SLscan. We compared it to Snyk which is also supported but requires an Enterprise plan which is too expensive for our small team.

The initial integration was rather quick and easy to set up. But ongoing I have seen a number or problems with it particularly around the inclusion of dev dependencies in the vulnerability scan and a massive increase of reported vulnerabilities on projects that haven't had any changes in the last few months.

cheers,
Mk

[prabhu]

@mkadp Thank you for your support and patience. This issue is resolved with the latest scan image and version 2.1.2. Please retest and let me know how it looks.